ERR_BLOCKED_BY_CLIENT: what it means and how to fix it

What ERR_BLOCKED_BY_CLIENT means

Chromium defines this error as code -20 with the comment "The client chose to block the request." The client is the browser and anything running inside it. Chrome, Edge, Brave, Opera and other Chromium-based browsers share one list of network errors, so they all use this name.

Extensions block requests with rules. Chrome's declarativeNetRequest API lets an extension list rules that match a request by URL pattern, domain and resource type, and set the action to "block". Ad blockers ship thousands of rules, usually built from public filter lists such as EasyList and EasyPrivacy. When a script, image, frame or API call matches a rule, Chrome cancels it and reports ERR_BLOCKED_BY_CLIENT.

A rule sees only the address and the request type. It does not know what the file does, so harmless files with unlucky names get blocked too. This has two consequences:

• The request never reaches your server. Your access log, your CDN log and your application log have no line for it.
• A request for the same URL from another computer, another browser profile or a command-line tool such as curl normally succeeds.

How the error appears

What you see depends on what was blocked.

• A script, image, stylesheet, font or frame. The page loads, but a part is missing or a button does nothing. The visitor gets no error message. The details are only in the browser's developer tools.
• A fetch or XMLHttpRequest call. The call fails. In JavaScript, fetch() rejects with TypeError: Failed to fetch. The page cannot tell a blocked request from a lost connection, because browsers hide the reason from page scripts.
• The page itself. If the address you opened is blocked, Chrome shows an error page that says the address is blocked. It shows the code ERR_BLOCKED_BY_CLIENT and a Reload button.

In the Console panel of Chrome DevTools (F12) the blocked requests look like this:

Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
POST https://stats.example.net/collect net::ERR_BLOCKED_BY_CLIENT
Uncaught (in promise) TypeError: Failed to fetch

In the Network panel the row is red and the Status column reads "(failed)" followed by the error message. The Initiator column shows which script or page asked for the URL, which tells you what depends on it.

ERR_BLOCKED_BY_CLIENT vs similar errors

Chromium has several "blocked" errors. They differ in who did the blocking, and that decides where you look first. The numbers are Chromium's internal error codes.

Error	What happened at the network or protocol level	Where to look first
ERR_BLOCKED_BY_CLIENT (-20)	The browser, usually through an extension, canceled the request before sending it.	Extensions, the browser's built-in blocker, then the DevTools Network panel.
ERR_BLOCKED_BY_ADMINISTRATOR (-22)	A URL block list set by the device or domain administrator stopped the request.	chrome://policy and your IT administrator.
ERR_BLOCKED_BY_CSP (-30)	The page's own Content Security Policy does not allow loading that URL.	The Console message "Refused to load..." and the page's Content-Security-Policy header.
ERR_BLOCKED_BY_RESPONSE (-27)	The response arrived, but its headers (X-Frame-Options, CSP frame-ancestors, Cross-Origin-Resource-Policy) forbid using it in this context.	The response headers of the blocked resource.
ERR_BLOCKED_BY_ORB (-32)	Chrome's cross-origin read blocking (ORB, the successor of CORB) discarded a cross-origin response that did not fit the request.	The Content-Type of the response and how the page requested it.
ERR_NAME_NOT_RESOLVED (-105)	A DNS lookup returned no address. A network-level DNS filter can block a domain this way, without the browser doing any blocking.	The DNS server the device uses: router, filtering resolver, or VPN.

What causes ERR_BLOCKED_BY_CLIENT

• An ad blocker extension. Its rules match the URL of an ad, a tracker or a look-alike. This is the usual cause.
• A privacy or anti-tracking extension. These block analytics scripts, tracking pixels, social buttons and some third-party widgets.
• A built-in blocker. Some browsers, Brave for example, block ads and trackers without any extension (Brave calls this feature Shields).
• A security suite's browser extension. Antivirus and "safe browsing" add-ons can block addresses they rate as risky.
• A parental control or content filter extension. It blocks by category and can return the same error.
• A work-installed extension. A company can push an extension to its staff browsers, and its rules apply even if you never installed anything.
• A script-blocking or custom-rule tool. A rule you wrote months ago can still be active.
• A leftover DevTools rule. The "Network request blocking" tab in DevTools blocks matching URLs on purpose for testing, and its patterns stay until you remove them.

How to fix it if you are a visitor

1. Open the page in a private window. Press Ctrl+Shift+N (Cmd+Shift+N on a Mac) in Chrome or Edge. Extensions are off in these windows unless you allowed them. If the page works there, an extension is the cause.
2. Pause your blocker for this site. Click its toolbar icon and choose the option to pause or disable it on this site. Then reload with Ctrl+Shift+R (Cmd+Shift+R on a Mac).
3. Find the extension that blocks. Open chrome://extensions (edge://extensions in Edge). Turn all extensions off, reload the page, then turn them on one at a time and reload after each. The one that brings the error back is the cause. Start with ad blockers, privacy tools and security add-ons.
4. Look in the blocker's own log. Many blockers show the blocked URLs and the rule that matched. That lets you allow one rule instead of switching the blocker off.
5. Allow the site, but only if you trust it. Most blockers have an allow list for sites or for single requests.
6. Check Shields in Brave. Click the lion icon in the address bar and turn Shields off for this site.
7. Check your security software. If your antivirus installed a browser extension, disable that extension for a test.
8. On a work or school device, an administrator may block sites by policy. That usually shows ERR_BLOCKED_BY_ADMINISTRATOR, and chrome://policy lists the rules. Ask your IT team.

How to fix it if you run the site

You cannot make a visitor's extension allow your request. You can make sure a block does no harm, and that your own files do not get blocked by mistake.

Prove that your server is fine

Request the blocked URL yourself, outside the browser, and look for it in your access log:

curl -I https://www.example.com/js/ads.js
HTTP/2 200
content-type: text/javascript

A 200 here, together with no log line for the visitor's request, shows that the block happened inside the visitor's browser.

Rename URLs that look like advertising

Public filter lists match on parts of the URL. Path words such as /ads/, /banner/, /sponsor/ or /tracking/, file names such as ads.js or analytics.js, and well-known ad and analytics hostnames commonly match. If your own, genuinely needed files carry such names, they can be blocked. Examples:

• An image folder called /ads/ that holds your own promotions: use /promo/ or /images/offers/.
• An endpoint /api/track-order that shows a customer where a parcel is: use /api/order-status.
• A report export at /analytics/export: use /reports/export.

Neutral names are free to use, and they prevent bug reports that only some customers can reproduce.

Make optional things optional

Analytics, chat widgets, ad slots and embeds are the usual targets. Write the page so that a failed load changes nothing important. Catch the error on every call to a third-party service:

async function sendEvent(payload) {
  try {
    await fetch('https://stats.example.net/collect', {
      method: 'POST',
      body: JSON.stringify(payload),
      keepalive: true,
    });
  } catch (err) {
    // Blocked, offline or CORS failure: the page cannot tell which.
    // Do not retry in a loop and do not show an error to the visitor.
  }
}

For a script that loads from another domain, set a flag when the load fails, and show a plain alternative:

<script src="https://cdn.example.net/chat-widget.js" async
        onerror="window.chatUnavailable = true"></script>

Your page code can then check window.chatUnavailable and show an email address or a contact form instead of an empty space. Never let a checkout, sign-up or login depend on a script that blockers commonly remove. If you must load a payment form from another domain, show a short hint such as "If the form does not appear, try a private window" next to it.

Test with a blocker turned on

Create a clean browser profile, install one popular ad blocker and one privacy extension, and walk through your sign-up, checkout and contact flows. Open the Network panel and look for red rows. Every red row is a request that some of your visitors never complete. Brave with its default settings is a quick second test.

Your server access log records every request that reaches the server, so blockers do not change it. Analytics scripts that run in the browser are affected, so their numbers can be lower than your server log suggests.

How it looks from the outside

A monitoring check does not run browser extensions. A check that fetches your page or the blocked file from many places measures your server, not your visitors' browsers, so it never produces this error. The pattern that points at a client-side block looks like this:

• The page and the blocked file return 200 from every location, with the right content type.
• The server log has no line for the failed request from the affected visitors.
• Only some visitors report the problem, and it goes away in a private window or another browser.

If a check fails from some or all locations, the cause is on the server side and not in the visitor's browser. In that case start with the guide to checking whether a website is down for everyone or just you.

The HTTP check requests a URL from several locations, so you can run it on the exact file that users report as blocked. HostTracker runs checks from 300+ checkpoints in 158 cities and can send an alert by email, SMS, voice call, Slack, Telegram and more if that file starts failing on the server.

Frequently asked questions

Is ERR_BLOCKED_BY_CLIENT a virus or a hack?

No. It is a normal message from your own browser. It usually means a tool you installed on purpose, such as an ad blocker, did its job. If you do not remember installing the extension, review the list at chrome://extensions.

Does it mean the website is down?

No. The request never left your browser, so the state of the server did not matter for it. If the whole page does not open, the error is something else, and the table above shows how to tell. You can check the site from other places with a website down checker.

Why do I see it in the console, but the page works?

Because the blocked file was optional, for example an analytics script or an ad. The page still works without it, and the Console records every blocked request anyway. A few red rows on a page full of ads are normal on a computer with a blocker.

Why does it happen only on my computer?

Extensions, their rules and the allow lists belong to one browser profile. Another computer or another profile may have different extensions. This is also why the problem is hard to reproduce for the site owner.

Can I fix it from the website's side?

Partly. You can rename URLs that look like ads or trackers, make third-party scripts optional, and add a fallback for essential features. You cannot force an extension to allow a request, and you should not try to hide trackers or ads from blockers.

Does it happen in Firefox and Safari?

The name ERR_BLOCKED_BY_CLIENT belongs to Chromium browsers: Chrome, Edge, Brave, Opera and similar. Firefox and Safari have their own content blockers and word their messages differently. The cause is the same: the browser or an add-on canceled the request.

Why does fetch only say "Failed to fetch"?

For privacy reasons, browsers give page scripts no detail about network failures. A script sees the same error for a blocked request, a lost connection and a CORS problem. The Console in DevTools shows the real reason to the person using the browser, but the page cannot read it.

Sources and further reading

• Chromium net error list: the definitions of BLOCKED_BY_CLIENT (-20) and the other "blocked" errors in the table above.
• chrome.declarativeNetRequest API: how extensions block network requests with rules.
• Chrome DevTools: Network features reference: the Status and Initiator columns and request blocking.
• EasyList: the public filter lists that many blockers build their rules from.